aerogear/aerogear-controller-demo — pull request #37 by abstractj (2013-02-28 05:56:03+00:00)
Title: AEROGEAR-976 - HSTS filter

## HSTS support

**HSTS** (HTTP Strict Transport Security) is a security policy mechanism which enforce users to interact with SSL connections only, preventing attacks like man-in-the-middle.

This implementation is based on [RFC 6797](http://tools.ietf.org/html/rfc6797) and depends on web browser implementation. Currently this implementation is supported only in Firefox and Chrome, for further details, please check [caniuse.com](http://caniuse.com/#search=hsts) or the RFC.

## Common questions?

* How it will work on non supported browsers?

- User will be redirected to HTTPS *location* attribute, but the browser won't be remembered to force HTTPS.

* Is it required on AeroGear Controller and Security?

- No, it's an optional feature

* With HSTS my system is bullet proof?

- Only if you're disconnect and your server is hosted in an island. Security is hard.

## Getting started

### 1. Configuration

#### Parameters on [web.xml]():

Basically, browsers that support this feature, are able to remember the fact that a particular website requires HTTPS only, the next visit the respective site the agent will remember about this option on HTTPS only.

* **max-age**: set how long the agent (browser) will be remembered to force HTTPS.
* **include-subdomain**: this rule will be applied to all the subdomains or not. (*accepted values*: true/false).
* **location:** when user try to access *http://aerogear.org* for example, the default behaviour is to response with *HTTP 301* (indicating a permanent redirect) pointing the browser to a new location.

#### JBoss configuration file:

To get started, please install and configure SSL support on JBoss [http://docs.jboss.org/jbossweb/3.0.x/ssl-howto.html](http://docs.jboss.org/jbossweb/3.0.x/ssl-howto.html).

You can do it with:

$JAVA_HOME/bin/keytool -genkey -alias tomcat -keyalg RSA

During the process make sure to setup the default password (*"changeit"*) already on JBoss, for testing purposes.

Copy this file [standalone.xml](https://gist.github.com/abstractj/a91c4fc960975a111803) to *$JBOSS_HOME/standalone/configuration/*.

### 2. Deploying

- Install AG Security

git clone git@github.com:abstractj/aerogear-security.git
cd aerogear-security && git checkout AEROGEAR-976
mvn clean install

- Install AG Security PicketLink

git clone git@github.com:abstractj/aerogear-security-picketlink.git
cd aerogear-security-picketlink && git checkout AEROGEAR-976
mvn clean install

- Deploy AG Controller demo

git@github.com:abstractj/aerogear-controller-demo.git
cd aerogear-controller-demo && git checkout AEROGEAR-976
mvn clean package
cp target/aerogear-controller-demo.war $JBOSS_HOME/standalone/deployments

### 3. Testing

- Visit [http://localhost:8080/aerogear-controller-demo](http://localhost:8080/aerogear-controller-demo) and the servlet filter will redirect you to *location* specified into the [web.xml](https://github.com/abstractj/aerogear-controller-demo/blob/AEROGEAR-976/src/main/webapp/WEB-INF/web.xml)

- Inspect HTTP headers on Chrome or Firefox.